VARA licence (Virtual Assets Regulatory Authority, Dubai)

In plain words

Think of Dubai as a city that decided crypto firms should get a trade licence for each trade, not one general permit. A jeweller who also wants to lend against gold needs a second approval for lending. In the same way, a crypto company that runs an exchange and also keeps customers’ coins needs approval for exchange and for custody. The body that hands out those approvals is VARA, the Virtual Assets Regulatory Authority.

VARA was set up under Dubai Law No. 4 of 2022 as the first regulator in the world built only for virtual assets. ¹ It licenses and supervises crypto businesses across Dubai, including free zones such as DMCC, with one important exception: the Dubai International Financial Centre (DIFC), which has its own regulator. So when people say “a Dubai crypto licence”, they usually mean a VARA licence.

The licence is not a single document that covers everything crypto. It lists the specific activities a firm is approved for, and each activity comes with its own rulebook on top of rules that every licensee must follow. Anything outside that list, such as using a stablecoin to pay a shop, falls under someone else’s rules.

Illustration

Who regulates crypto where in the UAE

Swipe sideways to see the whole diagram.

How it works

How a firm gets a VARA licence

Two licences, in order: a company licence to exist in Dubai, then VARA’s licence to do crypto.

1. 1

   Set up the company in Dubai

   A commercial licence from Dubai’s economy department or a free zone authority, with virtual asset activities named in it.

2. 2

   Apply to VARA for each activity

   A business plan, owners and managers, policies for AML, risk, technology and custody, and the activities you want.

3. 3

   Provisional approval, then build

   VARA reviews in stages. Early approval lets you prepare, hire and test, but not serve clients yet.

4. 4

   Full licence and supervision

   Once conditions are met, you can operate the approved activities only, under ongoing reporting and inspections.

Company licenceYou may exist in Dubai

VARA licenceYou may offer these activities

The stages exist for a reason. VARA wants to see real people, real systems and real controls before customers’ money arrives, not a promise on paper. A firm with provisional approval is still building; telling customers it is “licensed” at that point is a common and costly mistake. The exact steps and conditions are published by VARA and change over time, so always work from its current guidance. ¹

The activities VARA licenses

VARA’s regulations list the virtual asset activities that need a licence. You choose the ones you will actually offer, and each one brings its own rulebook. ¹

Most real businesses combine several. A retail app that lets people buy, hold and send crypto is usually a broker-dealer, a custodian and a transfer service at the same time, unless it uses another licensed firm for custody.

Illustration

Which rulebooks apply to one firm

Swipe sideways to see the whole diagram.

What a VARA licence covers, and what it does not

The payments line catches many founders. Under the Central Bank of the UAE’s payment token rules, paying for goods and services on the mainland with a stablecoin is a central bank matter, and only approved payment tokens can be used that way. ² A VARA licence lets a firm offer stablecoins as virtual assets to buy, sell or hold, not as a payment method in shops. Read why stablecoin use changes the UAE launch route for how this plays out in a product.

What VARA expects after the licence

The licence starts the obligations rather than ending them. These are the areas licensees spend most of their time on.

In practice, each of these needs evidence from the product. A compliance team cannot prove that client assets are separate, or that the travel rule was applied to a transfer, unless the platform records it.

VARA compared with the EU, UK and the Gulf

Most major markets now license crypto firms, and the ideas rhyme: know your clients, protect their assets, be honest in marketing. The structure differs a lot.

European Union

The biggest contrast is scope. A firm that becomes a CASP in, say, Lithuania or Ireland can passport its service across the EU, so one licence reaches hundreds of millions of people. A VARA licence reaches Dubai only, but VARA’s activity list is more granular, and it regulates areas such as crypto lending that MiCA left largely aside. A firm already licensed under MiCA still needs a separate UAE licence to serve clients from Dubai. ⁴

United Kingdom

UK crypto firms have so far needed an FCA registration focused on anti-money laundering, not full conduct and prudential rules. The UK is moving to a fuller regime closer to what VARA and MiCA already require. A UK registration gives no right to operate in Dubai.

Gulf and wider MENA

Inside the UAE, three regimes sit side by side, which is why the first decision is where to incorporate (see DIFC vs ADGM). Bahrain licenses crypto firms through its central bank in tiers, from simpler services to running an exchange. Saudi Arabia has not opened a comparable licence for retail crypto services, so firms there usually focus on other parts of the market. In each country, check the current position with local advisers before you plan a launch.

VARA, ADGM or DIFC: how to choose

For a crypto business, the three UAE options are all credible. The right one depends on who your clients are and what else you plan to do.

Two short scenarios show how this works. A team building a buy-and-hold app for Dubai residents, with an OTC desk on the side, typically looks at VARA broker-dealer and custody approval, or partners with a licensed custodian. An asset manager in Abu Dhabi that wants to add a crypto fund next to its existing funds usually stays in ADGM, so one regulator sees the whole business. For licences beyond crypto, read UAE payment licences explained.

Example: a broker adds custody and stablecoins

Common misconceptions

FAQ